vincbeck commented on PR #54987: URL: https://github.com/apache/airflow/pull/54987#issuecomment-3229524552
> > > > To fix that, I introduce a new action LIST so that admins can easily give LIST access to all Dags but GET access only on few Dags. > > > > > > > > > So is the goal that the user should call list and be able to see a list of all dag ids but can only view the dag runs, code, etc for the dags they have permissions to get? > > > Is there a case where we want a user to not even be able to see the dag ids of dags they don't have access to? This is kind of a middle ground between how it works today and what I described above. > > > I kind of expected that when this hypothetical users calls LIST they should only get one item back in this case the `test` dag they have access to. > > > > > > It is a good question, there is basically 2 operations. When a user call list Dags, a permission check is performed to check whether the user is authorized to list Dags. If so, the operation continues, if not, they get a 403. If they have permissions to list Dags, then the list Dags API calls `get_authorized_dag_ids` (from auth manager) to retrieve only Dags the user has access to. > > Here I focus only on the first check, which is: "whether the user is authorized to list Dags". Hope that helps :) > > Ahh okay, so it is true that the final result (for this hypothetical) is that the user will only see the `test` dag, right? Yes :) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
